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UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF VIRGINIA 



Alexandria Division 



JUL 2 3 2M 



"ftciS IIS OtSlKSW Ui 



UNITED STATES OF AMERICA 
v. 

TIMOTHY ROBERT McCLAIN, 
Defendant. 



Criminal No. 1 :12-cr-383-l 1 
Hon. Liam O' Grady 



STATEMENT OF FACTS 
The United States and the defendant, Timothy Robert McClain, agree that had this matter 
proceeded to trial, the United States would have proven the following facts in the Eastern District 
of Virginia and elsewhere beyond a reasonable doubt, through witnesses, testimony, and other 
competent and admissible evidence: 

1 . Between on or about September 16, 2010 and at least January 2, 201 1, individuals 
participated in a worldwide conspiracy as part of the online group ANONYMOUS in a campaign 
dubbed "OPERATION PAYBACK" (or "OPERATION: PAYBACK IS A BITCH,") to engage in 
a coordinated scries of illegal cyber-attacks against victims. 

2. OPERATION PAYBACK targeted victims worldwide and in the Eastern District 
of Virginia, including dozens of governmental entities, trade associations, individuals, law firms, 
and financial institutions, which ANONYMOUS claimed opposed its staled philosophy of 
making all information free for all, including information protected by copyright laws or national 
security considerations. 

3. To carry out OPERATION PAYBACK, participants agreed to engage in an 
onslaught of cyber-attacks to damage and impair websites and computer systems by flooding 
those websites with a huge volume of irrelevant Internet traffic. This method of online attack 



Page 1 of 6 



Case l:13-cr-00383-LO Document 323 Filed 07/23/14 Page 2 of 6 PagelD# 2027 



designed to shut down victim websites is known as a Distributed Denial of Service ("DDoS") 
attack. One of the stated goals of these DDoS attacks was to cause significant monetary and 
other damage to the victim targets, and members of ANONYMOUS coordinated the times and 
targets for the attacks through online announcements or in dedicated Internet Relay Chat 
channels, including the #command, #saveTPB, #savethepiratebay, and #operationpayback 
channels. OPERATION PAYBACK ultimately caused at least $8.9 million in damage and loss to 
United States-based victims. 

4. The weapon of choice used by participants in OPERATION PAYBACK included 
specifically-designed online weapons such as the Low Orbit Ion Cannon ("LOIC"), a 
downloadable network stress testing program, and similar programs including Java LOIC and 
hping3. LOIC, for example, allowed participants individually to choose whether to attack in 
"Manual Mode (for pHfc)" or as part of a group in "F^HlNG HIVE MIND" mode. After 
picking the mode of attack and entering the target location, individuals could attack en masse by 
clicking a button labeled "IMMA CHARGIN MAH LAZER" to join in the cyber-assaults. 

5. Participants in OPERATION PAYBACK, including the defendant, engaged in 
illegal DDoS attacks during the conspiracy, including against the following victims: the Motion 
Picture Association of America; the Recording Industry Association of America; the British 
Phonographic Institute; the law firm ACS:Law; the trade association BREIN foundation; the 
Australian Federation Against Copyright Theft; the law firm Davenport Lyons; the Association 
of Commercial Audiovisual of Portugal; the private company Web Sheriff; the consulting firm 
DGLegal; the record label Ministry of Sound; the Spanish General Society of Authors and 
Publishers; the Spanish Ministry of Education, Culture, and Sport; the Spanish trade group 
Promusicae; the Federal Italian Music Industry; the International Federation of Phonographic 
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Industry; the directory of websites pro-music. it; the law firm Gallant MacMillan; Gene 
Simmons; the copyright licensing agency Access Copyright; the British Intellectual Property 
Office; the movie production company Satel Film; the Copyright Information and Anti-Piracy 
Centre in Finland; the U.S. Copyright Office of the Library of Congress; the intellectual property 
entity Hadopi; the Ireland National Federation against Copyright Theft; the Irish Recorded Music 
Association; the Fight Piracy Organization; the International Federation of the Phonographic 
Industry; Warner Brothers; the payment services provider PostFinance; the Swedish Prosecutor's 
office; everydns.com; the law firm Borgstrom and Bodstrom; MasterCard; Visa; the online 
payment service Moneybookers.com; PayPal; the Recording Industry of South Africa; Amazon; 
the firm Arbor Networks; and Bank of America. 

6. In early December 20 1 0, the defendant participated in the DDoS cyber-attack on 
the website of MasterCard, in concert with his co-conspirators, by flooding the website of 
MasterCard with requests in an effort to make the website inoperable. The defendant also 
participated in an attack on www.genesimmons.com. During a voluntary interview with law 
enforcement officers on January 27, 201 1, the defendant also admitted to having downloaded the 
LOIC tool and Hping to attack MasterCard. A forensic examination confirmed that the defendant 
had been in OPERATION PAYBACK IRC Channels and had used LOIC-related tools on his 
computers. 

7. Witness testimony, business records, and other evidence would further establish 
that beginning on or about September 16, 2010 and continuing up until January 2, 201 1, 
participants of OPERATION PAYBACK, including DENNIS OWEN COLLINS, JEREMY 
LEROY HELLER, ZHIWEI CHEN, JOSHUA S. PHY, RYAN RUSSELL GUBELE, ROBERT 
AUDUBON WHITFIELD, ANTHONY TADROS, GEOFFREY KENNETH COMMANDER, 
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PHILLIP GARRETT SIMPSON, AUSTEN L. STAMM, TIMOTHY ROBERT McCLAIN, 
WADE CARL WILLIAMS, and THOMAS J. BELL, knowingly and intentionally conspired and 
agreed amongst themselves and together with others to commit an offense against the United 
States, that is, to knowingly cause the transmission of a program, information, code, and 
command, and, as a result of such conduct, intentionally cause damage, and attempt to cause 
damage, without authorization, to a protected computer. 

8. The statement of facts includes those facts necessary to support the defendant's 
guilty plea. It does not include each and every fact known to the defendant or to the 
government and it is not intended to be a full enumeration of all of the facts surrounding the 
defendant's cases. 

9. The actions of the defendant, as recounted above, were in all respects knowing 
and intentional, and were not committed by mistake, accident or other innocent reason. 
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10. The defendant and the United States agree that this statement of facts is 
admissible in any proceeding against defendant regardless of whether the plea agreement is 
presented to or accepted by a court. Moreover, the defendant waives any rights that he may have 
under Federal Rule of Evidence 410 regarding this statement of facts. 



Dana J. Boente 
United States Attorney 

Bv: C sW^~ Z£ A. 
Alexander T.H. Nguyen Si 
Jay V. Prabhu // 
Assistant United States Attorneys 



Richard D. Green 

Trial Attorney, U.S. Department of Justice 
Computer Crime & Intellectual Property Section 
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Defendant's Signature: After consulting with my attorney, 1 hereby stipulate thai the above 
Statement of Facts is true and accurate, waive my rights under Federal Rule of Evidence 410 
related to this Statement of Facts, and agree that had the matter proceeded to trial, the United 
States would have proved the same beyond a reasonable doubt. 



Defense Counsel Signature: 1 am Timothy Robert McClain's attorney. I have carefully 
reviewed the above Statement of Facts with him. To my knowledge, his decision to stipulate to 
these facts is an informed and voluntary one. 




Defendant 




Gretchen Lynch Taylor, Es 
Counsel for the Defendant 



sq. 
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